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We claim: 

1 . A computer-readable medium whose contents cause a computer system to 
perform selective virus signature scanning against a target file associated with an executing 
agent, the computer system having an anti-virus program with instructions to perform the steps 

of: 

organizing virus signatures into a plurality of anti-virus sets where each set contains a 

characteristic shared by all the virus signatures within the set; 

associating a portion of the plurality of anti-virus sets with the executing agent; and 
scanning the contents of the target file for a virus signature which matches a virus 

signature stored in the associated one or more anti-virus sets. 

2. The computer-readable medium of claim 1 further comprising a step before the 
scanning step, the step comprising: 

associating a rule with the executing agent to indicate a manner in which the associated 
portion of the plurality of anti-virus sets are applied. 

3. The computer-readable medium of claim 1 wherein the associating step includes 
providing user selectable options. 

4. The computer-readable medium of claim 2 wherein the rule applied includes a 
periodic batch scan of one or more target files. 
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5. The computer-readable medium of claim 2 wherein the manner in which the 
associated portion of the plurality of anti-virus sets are applied to executing agent's target files 
includes a trigger mechanism which invokes subsequent scanning of the executing agent's target 
files. 

6. The computer-readable medium of claim 5 wherein the trigger mechanism 
includes applying the scanning step upon a request for a file operation on the target file. 

7. The computer-readable medium of claim 5 wherein the trigger mechanism 
includes applying the scanning step periodically on one or more target files associated with the 
executing agent. 

8. The computer-readable medium of claim 1 further comprising a step before the 
organizing step, the step comprising: 

determining the plurality of executing agents installed on the computer system. 

9. The computer-readable medium of claim 1 wherein the plurality of anti-virus sets 
have a first anti- virus set and a second anti-virus set, the organizing step further comprises: 

arranging the plurality of anti-virus sets into a hierarchical structure having first and 
second levels, the first level having the first anti-virus set containing virus signatures which are 
mutually applicable to a plurality of executing agents, the second level having the second anti- 
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virus set containing virus signatures which are exclusively applicable to the first portion of the 
plurality of executing agents. 

10. The computer-readable medium of claim 1 

wherein the plurality of anti-virus sets have a first anti-virus set, a second anti-virus set, 
and a third anti-virus set, 

wherein the plurality of executing agents has a first portion, 
wherein the organizing step further comprises: 

arranging the plurality of anti-virus sets into a hierarchical structure having a first level, a 
second level, and a third level, the first level having the first anti-virus set containing virus 
signatures which are mutually applicable to a plurality of executing agents, the second level 
having the second anti-virus set containing virus signatures which are mutually applicable to the 
first portion of the plurality of executing agents, the third level having the third anti-virus set 
containing virus signatures which are exclusively applicable to one of the first portion of the 
plurality of executing agents. 

11. A computer system for performing selective virus signature scanning against a 
target file associated with an executing agent, the computer system having an anti-virus program 
comprising: 

means for organizing virus signatures into a plurality of anti-virus sets where each set 
contains a characteristic shared by all the virus signatures within the set; 
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means for associating a portion of the plurality of anti-virus sets with the executing agent; 

and 

means for scanning the contents of the target file for a virus signature which matches a 
virus signature stored in the associated one or more anti-virus sets. 

12. The computer system of claim 1 1 further comprising: 

means for associating a rule with the executing agent to indicate a manner in which the 
associated portion of the plurality of anti-virus sets are applied. 

13. The computer system of claim 12 wherein the rule includes a periodic batch scan 
of one or more target files. 

14. The computer system of claim 12 wherein the manner in which the associated 
portion of the plurality of anti-virus sets are applied to executing agent's target files includes a 
trigger mechanism for activating the means for scanning. 

15. The computer system of claim 14 wherein the trigger mechanism includes 
activating the means for scanning step upon a request for a file operation on the target file. 

16. The computer system of claim 14 wherein the trigger mechanism includes 
applying the scanning step periodically on one or more target files associated with the executing 
agent. 



20 IBM Ref. No. RSW920030166US1 

17. The computer system of claim 1 1 further comprising: 

means for determining the plurality of executing agents installed on the computer system. 

1 8. The computer system of claim 1 1 wherein the plurality of anti- virus sets have a 
first anti-virus set and a second anti-virus set, the means for organizing further comprises: 

means for arranging the plurality of anti-virus sets into a hierarchical structure having 
first and second levels, the first level having the first anti-virus set containing virus signatures 
which are mutually applicable to a plurality of executing agents, the second level having the 
second anti-virus set containing virus signatures which are exclusively applicable to the first 
portion of the plurality of executing agents. 

19. The computer system of claim 1 1 

wherein the plurality of anti-virus sets have a first anti- virus set, a second anti-virus set, 
and a third anti-virus set, 

wherein the plurality of executing agents has a first portion, 
wherein the, means for organizing further comprises: 

means for arranging the plurality of anti-virus sets into a hierarchical structure having a 
first level, a second level, and a third level, the first level having the first anti-virus set containing 
virus signatures which are mutually applicable to a plurality of executing agents, the second level 
having the second anti-virus set containing virus signatures which are mutually applicable to the 
first portion of the plurality of executing agents, the third level having the third anti- virus set 
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containing virus signatures which are exclusively applicable to one of the first portion of the 
plurality of executing agents. 

20. A method for performing selective virus signature scanning against a target file 
associated with an executing agent comprising: 

organizing virus signatures into a plurality of anti- virus sets where each set contains a 

characteristic shared by all the virus signatures within the set; 

associating a portion of the plurality of anti-virus sets with the executing agent; and 
scanning the contents of the target file for a virus signature which matches a virus 

signature stored in the associated one or more anti-virus sets. 

21 . The method of claim 20 further comprising a step before the scanning step, the 
step comprising: 

associating a rule with the executing agent to indicate a manner in which the associated 
portion of the plurality of anti-virus sets are applied. 

22. The method of claim 21 wherein the rule includes a periodic batch scan of one or 
more target files. 

23. The method of claim 20 wherein the associating step includes providing user 
selectable options. 
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24. The method of claim 21 wherein the manner in which the associated portion of 
the plurality of anti-virus sets are applied to executing agent's target files includes a trigger 
mechanism for subsequent scanning of the executing agent's target files. 

25. The method of claim 24 wherein the trigger mechanism includes applying the 
scanning step upon a request for a file operation on the target file. 

26. The method of claim 24 wherein the trigger mechanism includes applying the 
scanning step periodically on one or more target files associated with the executing agent. 

27. The method of claim 20 further comprising a step before the organizing step, the 
step comprising: 

determining the plurality of executing agents installed on the computer system. 

28. The method of claim 20 wherein the plurality of anti-virus sets have a first anti- 
virus set and a second anti-virus set, the organizing step further comprises: 

arranging the plurality of anti-virus sets into a hierarchical structure having first and 
second levels, the first level having the first anti-virus set containing virus signatures which are 
mutually applicable to a plurality of executing agents, the second level having the second anti- 
virus set containing virus signatures which are exclusively applicable to the first portion of the 
plurality of executing agents. 
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29. The method of claim 20 

wherein the plurality of anti-virus sets have a first anti-virus set, a second anti-virus set, 
and a third anti-virus set, 

wherein the plurality of executing agents has a first portion, 
wherein the organizing step further comprises: 

arranging the plurality of anti-virus sets into a hierarchical structure having a first level, a 
second level, and a third level, the first level having the first anti-virus set containing virus 
signatures which are mutually applicable to a plurality of executing agents, the second level 
having the second anti-virus set containing virus signatures which are mutually applicable to the 
first portion of the plurality of executing agents, the third level having the third anti-virus set 
containing virus signatures which are exclusively applicable to one of the first portion of the 
plurality of executing agents. 



